Skip to content
HACKTECH

Cyber news digest

What broke, and what we check because of it.

Breaches, exploited vulnerabilities, supply chain compromises and new rules, written up for the people who buy security work, with what each one means for an organisation that runs the same kind of systems. Every item cites at least two sources and was verified against them before publication.

52 items214 cited sourcesLatest item 5 November 2026

Showing 5 items in Regulation. Show all 52 items

November 2026

1 item

  • Regulation

    UK Cyber Security and Resilience Bill clears the Lords and returns to the Commons

    The Cyber Security and Resilience (Network and Information Systems) Bill completed its House of Lords third reading on 2 November 2026 and is now at consideration of Lords amendments in the House of Commons, according to the UK Parliament bill record. Introduced on 12 November 2025, the bill would reform the Network and Information Systems Regulations 2018 and, according to the government, bring medium and large managed service providers into regulation for the first time and data centres into scope. As introduced, organisations in scope would have to report more harmful cyber incidents to their regulator and the National Cyber Security Centre within 24 hours, with a full report within 72 hours.

    • Incident response
    • Network & infrastructure testing
    • Cloud configuration review

September 2026

1 item

  • Regulation

    Cyber Resilience Act reporting duties begin as ENISA launches Single Reporting Platform

    Since 11 September 2026, manufacturers of products with digital elements made available on the EU market must report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act, according to the European Commission. Reports go through the Single Reporting Platform that ENISA launched the same day: an early warning within 24 hours of becoming aware, a full notification within 72 hours, and a final report no later than 14 days after a corrective measure is available for vulnerabilities, or within a month of the 72-hour notification for severe incidents. The Commission says the duty also covers products placed on the market before the CRA's main obligations apply on 11 December 2027.

    • Incident response
    • Application security audit
    • Threat modelling

August 2026

1 item

  • Regulation

    EU AI Act enforcement and transparency rules start as AI Omnibus delays high-risk rules

    The EU AI Act became applicable on 2 August 2026, when the European Commission's AI Office and national authorities began enforcing it and its transparency rules for chatbots, deepfakes and AI-generated content took effect, according to the Commission and Help Net Security. The AI Omnibus amendments, proposed on 19 November 2025, agreed on 7 May 2026 and in force since 27 July 2026, set 2 December 2027 for Annex III high-risk systems and 2 August 2028 for high-risk AI embedded in regulated products. Help Net Security reported that ignoring the transparency obligations risks fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher.

    • AI & LLM application testing
    • Social engineering assessment
    • Threat modelling

July 2026

1 item

  • Regulation

    Israel's privacy regulator fines Meuhedet NIS 256,000 for late breach report

    Israel's Privacy Protection Authority (PPA) imposed a NIS 256,000 sanction on the Meuhedet health fund on 21 July 2026 for failing to report a serious security incident immediately. Legal commentaries say a fault in a digital system let insured persons, in certain circumstances, view relatives' medical files, and that Meuhedet knew of it by November 2025 but reported it on 27 January 2026. Commentators describe it as the first financial sanction since Amendment 13 to the Protection of Privacy Law took effect on 14 August 2025. Further sanctions followed, including NIS 64,000 against Beit Shemesh Municipality in September 2026.

    • Application security audit
    • Web application testing
    • Database security audit

January 2026

1 item

  • Regulation

    CNIL fines Free Mobile and Free €42 million over security failures behind 2024 breach

    France's data protection authority, the CNIL, said on 14 January 2026 that it had fined Free Mobile €27 million and Free €15 million for inadequate security of subscriber data. According to the CNIL, an attacker who infiltrated the companies' systems in October 2024 accessed personal data relating to 24 million subscriber contracts, including IBANs. The regulator found VPN authentication that was not strong enough, ineffective detection of abnormal behaviour, breach notification emails missing required information and, at Free Mobile, excessive retention of former subscribers' data.

    • Network & infrastructure testing
    • Incident response
    • Database security audit

Run the checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Book the scoping callHow incident response works